GitHub Advisoryadvisory · Maven

GHSA-r47r-87p9-8jh3 Spring Vault vulnerable to insertion of sensitive information into a log file

MEDIUM Published 2023-03-23 Modified 2023-03-28 Official page ↗
Aliases
CVE-2023-20859
Ecosystem
Maven
Packages
org.springframework.vault:spring-vault-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-03-23

Affected packages

• Maven org.springframework.vault:spring-vault-core: >= 3.0.0, < 3.0.2 → fixed in 3.0.2 • Maven org.springframework.vault:spring-vault-core: < 2.3.3 → fixed in 2.3.3

Description

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Related

Alias · CVE (1)

  • CVE-2023-20859 In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References